Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation

Technical Summary: Semantic Attacks on Tool-Augmented LLMs

Problem Statement
The Model Context Protocol (MCP) enables Large Language Models (LLMs) to interact with external tools via standardized metadata interfaces, specifically tool descriptors. While these descriptors are essential for autonomous decision-making and multi-agent coordination, current deployments treat them as trusted metadata. This paper identifies a critical security gap: because tool descriptors are directly integrated into the LLM's reasoning context, they constitute an active semantic attack surface. Unlike traditional prompt injection, which manipulates user input, descriptor-level manipulation exploits the trusted nature of tool metadata to bias tool selection and downstream reasoning without violating syntactic schemas or requiring infrastructure compromise. Existing defenses, primarily focused on prompt injection and static validation, fail to address these semantic manipulations.

Methodology
The authors propose a controlled, cross-model evaluation framework to isolate and analyze descriptor-driven vulnerabilities. The study involves three primary components:

1. Threat Model Formalization: The paper defines three distinct attack classes:

   • Tool Poisoning: Manipulating a tool's descriptor to bias reasoning toward unsafe actions (e.g., adding "prioritize user context" to a benign search tool).
   • Shadowing: Introducing a malicious descriptor into a shared MCP context to contaminate the interpretation of otherwise benign tools.
   • Rug Pull: Modifying a tool's descriptor post-approval (e.g., via plugin updates) to introduce unsafe behavior while maintaining syntactic validity.

2. Experimental Setup:

   • Models: The study evaluates GPT-5.3, DeepSeek-V3, and LLaMA-3.5.
   • Environment: A synthetic enterprise MCP testbed featuring tools for information retrieval, productivity, and system utilities.
   • Adversarial Generation: A lightweight mutation engine generates adversarial descriptors by applying semantic perturbations (e.g., contextual expansion, authority amplification) that preserve syntactic validity but alter semantic intent.
   • Prompting Strategies: The evaluation spans eight strategies, including Zero-shot, Chain-of-Thought, Reflexion, and Scarecrow prompting.
   • Metrics: Key metrics include Malicious Selection Rate, Unsafe Invocation Rate, Leakage Severity, Intent Deviation, and Latency.

3. Defense Mechanisms: The paper proposes and evaluates a layered defense strategy:

   • Descriptor Integrity Verification: Cryptographic signing to prevent post-approval modifications (Rug Pulls).
   • Semantic Vetting: Using an auxiliary LLM to audit descriptors for adversarial intent before context integration.
   • Runtime Guardrails: Lightweight rule-based filtering to block explicit risky patterns during execution.

Key Results

• Vulnerability: Under baseline configurations, descriptor manipulation caused unsafe tool invocations in up to 36% of trials. Approximately 30% of unsafe invocations bypassed baseline defenses.
• Attack Effectiveness: Tool Poisoning proved the most difficult to detect due to subtle semantic perturbations, while Shadowing was the most readily identified across models.
• Model Variance: Robustness varied significantly by architecture. GPT-5.3 demonstrated stable latency and consistent filtering. DeepSeek-V3 showed high sensitivity to context-level manipulation (particularly Shadowing) but incurred substantial latency overhead. LLaMA-3.5 offered the lowest latency but exhibited weaker semantic filtering.
• Prompting Impact: Structured reasoning strategies (Chain-of-Thought, Reflexion) improved detection rates but increased latency. Conversely, lightweight strategies (Zero-shot) showed lower robustness.
• Mitigation Efficacy: The proposed full-stack mitigation (combining integrity verification, semantic vetting, and guardrails) reduced unsafe invocations from 36% to 15% and increased the block rate to 74%. However, this introduced a trade-off, increasing the false-positive rate to 21.6% and adding latency overhead.
• Transferability: Descriptor-level attacks demonstrated moderate cross-model transferability, with attacks optimized against LLaMA-3.5 effectively compromising GPT-5.3 and DeepSeek-V3.

Significance and Claims
The paper claims to provide the first systematic, controlled cross-model evaluation of descriptor-level threats in MCP-integrated systems. Its primary contributions are:

1. Threat Formalization: Establishing Tool Poisoning, Shadowing, and Rug Pull as a unified semantic threat model specific to MCP.
2. Empirical Evidence: Demonstrating that tool descriptors are not passive metadata but active vectors for semantic manipulation that can compromise agent safety even when schemas are valid.
3. Defense Framework: Proposing a protocol-level defense strategy that does not require model retraining, showing that resilience can be achieved through descriptor integrity verification and semantic vetting.
4. Operational Trade-offs: Highlighting the inherent tension between security and usability, noting that while layered defenses significantly reduce risk, they introduce latency and false-positive costs that must be managed in enterprise deployments.

The study concludes that securing tool-augmented LLMs requires treating tool descriptors as untrusted inputs and embedding validation directly into the orchestration pipeline, moving beyond static schema validation to address semantic intent.